What does HTTP status 419 (Page Expired) mean?

HTTP_STATUS_PAGE_EXPIRED

Laravel uses this response when a request cannot pass its CSRF protection, frequently because the page contains an expired token or the session cookie was lost. It is not a standard HTTP status code.

Refresh the page before resubmitting, verify that the CSRF token is included, and check session cookie domain, SameSite, HTTPS, and reverse-proxy configuration. Do not disable CSRF protection to hide the symptom.

Laravel: CSRF Protection

Operational meaning of HTTP 419 for HTTP_STATUS_PAGE_EXPIRED

HTTP 419 (this result) is a client-error response. AllStat records its meaning as “419 Page Expired”. Interpret it with the request method, selected representation, response headers, and the specification or product that defines the code; the number alone does not prove that application work completed.

Client and server handling

• Treat this result as a condition visible at the request boundary; inspect authentication, syntax, preconditions, routing, and resource state before retrying.
• preserve the response body and challenge or retry-related headers because they often carry the actionable reason.
• automatic retry is safe only when the method and status contract allow it and the request has been corrected.

For telemetry, record HTTP 419, method, authority, route template rather than secrets, response headers relevant to caching or retry, latency, upstream identity, and whether the response originated at the application or an intermediary.

Looking for a different code? Search another status or error code.